CVE-2018-16333 Memory corruption in n/a

High 7.5 Published 2 Sep 2018 Updated 5 Aug 2024

A buffer overflow in the Tenda router web server allows remote attackers to execute arbitrary code via a crafted POST request.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-16333?

CVE-2018-16333 is a high-severity memory corruption vulnerability in n/a, published on 2 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.

Weakness: CWE-119

Which versions are affected by CVE-2018-16333?

It affects 5 products.

Products include Tendacn Ac10 Firmware, Tendacn Ac15 Firmware, Tendacn Ac18 Firmware, Tendacn Ac7 Firmware, Tendacn Ac9 Firmware.

How do I fix CVE-2018-16333?

No fix has been published for CVE-2018-16333 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-16333 being exploited?

There is no known exploitation of CVE-2018-16333 in the wild and no public exploit code.

Sources

Also known as GHSA-3mg9-cvj8-qmx7.